Sandbox reports pair written files with Windows Run targets
Three sandbox reports each record a written `bin.exe` location paired with a Windows Run entry targeting that location. Two also record HTTP POSTs to one domain, while the third records the same path on another. The records support persistence preparation and a recurring outbound request pattern, not a later logon launch or completed command exchange.
Two sandbox reports recorded HTTP POST requests to spaines.pw/EiDQjNbWEQ/. A third recorded a POST to the identical path on a different domain, vcklmnnejwxx.pw. Alongside those requests, each report contained a written bin.exe path and a Windows Run entry pointing to that report’s corresponding file location. The question is not simply whether these are suspicious names, but how far the recorded relationships establish a mechanism: a program configured to return at logon and communicate…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read